Can you tel geoip blocking, to drop the country instead of rejecting the country?

1

Hey every one,
I was looking around to do some geoblocking, and I notice that as default geoip blocking will reject the connection instead of dropping is it a way to do it trough the geoip blocking tap (dropping the connection) ore is it only trough rule set ? like this treat?: https://community.ipfire.org/t/manually-set-geoip-blocking-firewall-rule/2459

Best Regards

Neopegasus

2

According the sourcecode the default GeoIP will already use the DROP target.

See
https://git.ipfire.org/?p=ipfire-2.x.git;a=blob;f=config/firewall/rules.pl;h=387a8f92ba232dccf6308ae56badc5717a086ff5;hb=96253783d49c51e953e8d10fb24b2486226ed75e
line 627

3

Thanks Arne.F,
I ask that because in the wiki they quote:

After having finished that, scroll down at the end of the page and click “Save”. After that, any connections from those countries will be rejected instantly, even before passing some other firewall rules, e.g. port forwarding, which might allow them.

This info I got from: https://wiki.ipfire.org/configuration/firewall/geoip-block

After this information I was wondering why reject and not dropping the connection.

Thanks for the Help Arne.

4

Arne is correct. We want to DROP here, because there is no reason to even send an ICMP error message to the peer.

Please update the documentation to make it clear :slight_smile:

1 Like